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Amendments to the Claims 

Please amend claims to be as follows. 

1 . (currently amended) A method for remote mirroring of network traffic 
between a first network layer 2 domain and a second network layer 2 domain, 
the method comprising: 

receiving by an entry device a data packet to be remotely mirrored from 
the first network layer 2 domain, wherein the entry device is pre- 
configured with a destination Internet Protocol (IP) address to 
which to mirror the data packet, and the destination IP address is 
associated with a remote exit device in the second network layer 2 
domain; 

generating and adding an IP header to IP encapsulate the data packet, 
wherein the IP header includes the destination IP address; [[and]] 

foHA^arding the IP-encapsulated packet to an exit device associated with 
the destination IP address ; and 

configuring the entry device in a best effort mirroring mode to reduce 
head-of-line blocking . 

2. (previously presented) The method of claim 1 , further comprising: 

determining a media access control (MAC) address associated with the 

destination IP address; 
generating and adding a MAC header to the IP-encapsulated packet to 

form a MAC data frame, wherein the MAC header includes the 

MAC address in a destination field; and 
transmitting the MAC data frame to communicate the IP-encapsulated 

packet across the second network layer 2 domain to the remote 

exit device. 
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3, (original) The method of claim 2, wherein determining the MAC address 
comprises: 

determining if a mapping of the destination IP address to the MAC 

address is stored in an address resolution protocol (ARP) cache; 
if so, then retrieving the MAC address from the ARP cache; and 
if not, then broadcasting an ARP request with the destination IP address 
and receiving an ARP reply with the MAC address. 

4. (original) The method of claim 2, wherein the IP-encapsulated packet is 
communicated across at least one intermediate layer 2 domain. 



5. (original) The method of claim 1 , further comprising: 

receiving the IP-encapsulated packet by the exit device; and 
removing the IP header to de-encapsulate the packet. 

6. (original) The method of claim 1 , wherein the remote mirroring preserves an 
original format of the data packet. 

7. (original) The method of claim 1 , further comprising: 

pre-configuring the entry device to mirror data packets from at least one 
specified port of the entry device. 

8. (original) The method of claim 1 , further comprising: 

pre-configuring the entry device to mirror data packets which include a 
VLAN tag with at least one specified VLAN identifier. 

9. (original) The method of claim 1 , further comprising: 
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pre-configuring the entry device to mirror data packets which include MAC 
addresses that matches at least one entry in a MAC look-up table. 

10. (original) The method of claim 1, further comprising: 

pre-configuring the entry device to mirror data packets which include IP 
addresses that matches at least one entry in an IP hash table. 

11. (original) The method of claim 1, further comprising: 

pre-configuring the entry device to mirror data packets which include an 
IP destination address that matches at least one specified subnet 
entry in a best matching prefix (BMP) table. 

12. (original) The method of claim 1, further comprising: 

pre-configuring the entry device to mirror data packets matching at least 
one access control list (ACL) entry. 

13. (canceled) 

14. (original) The method of claim 1, further comprising: 

configuring the entry device in a lossless mirroring mode to assure 
completeness of mirrored traffic. 

15. (currently amended) Tho method of c l aim 1, further compris i ng: A method 
for remote mirroring of network traffic between a first network laver 2 domain 
and a second network laver 2 domain, the method comprising: 

receiving by an entry device a data packet to be remotely mirrored from 

the first network layer 2 domain, wherein the entry device is pre- 

confioured with a destination Internet Protocol (IP) address to 
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which to mirror the data packet, and the destination IP address is 
associated with a remote exit device in the second network layer 2 
domain: 

generating and adding an IP header to IP encapsulate the data packet 
wherein the IP header includes the destination IP address: 

fonA/ardino the IP-encapsulated packet to an exit device associated with 
the destination IP address: and 

truncating the data packet to reduce a size of the IP-encapsulated packet 
prior to forwarding thereof. 

16. (original) The method of claim 1, further comprising: 

compressing at least a portion of the data packet to reduce a size of the 
IP-encapsulated packet prior to forwarding thereof. 

17. (original) The method of claim 1, further comprising: 

encrypting at least a portion of the data packet to provide a level of 
security prior to forwarding the IP-encapsulated packet. 

18. (currently amended) A networking device configured with a mirroring 
capability to a remote exit device in a different network layer 2 domain, the 
networking device comprising: 

a plurality of ports for receiving and transmitting packets therefrom; 

a switching/routing engine coupled to the ports for transferring the packets 
therebetween; and 

a remote mirroring engine configured to detect packets from a specified 
mirror source, IP-encapsulate the detected packets with an internet 
protocol (IP) header, and forward the IP-encapsulated packets 
towards an IP destination by way of at least one of the ports^ 

wherein the device includes a best effort mirroring mode to reduce head- 
of-line blocking . 
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19. (original) The networking device of claim 18, wherein the specified mirror 
source comprises at least one of said ports. 

20. (original) The networking device of claim 18, wherein the specified mirror 
source comprises at least one specified VLAN. 

21. (original) The networking device of claim 18, wherein the specified mirror 
source comprises those packets matching entries in a look-up table. 

22. (original) The networking device of claim 18, wherein the specified mirror 
source comprises at least one specified subnet. 

23. (original) The networking device of claim 18, wherein the specified mirror 
source comprises those packets matching entries in an access control list. 

24. (canceled) 

25. (original) The networking device of claim 18, wherein the device includes a 
lossless mirroring mode to assure completeness of mirrored traffic. 

26. (currently amended) Th e n e tworking d e v i co of cla i m 18. A networking 
device configured with a mirroring capability to a remote exit device in a 
different network laver 2 domain, the networking device comprising: 

a plurality of ports for receiving and transmitting packets therefrom; 
a switching/routing engine couoled to the ports for transferring the packets 
therebetween: and 
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a remote mirroring engine configured to detect packets from a specified 
mirror source. IP-encapsulate the detected packets with an internet 
protocol (IP) header, and forward the IP-encapsulated packets 
towards an IP destination by way of at least one of the ports. 

wherein the device truncates the data packet to result in a size reduction 
of the IP-encapsulated packet prior to forwarding thereof. 

27. (original) The networking device of claim 18, wherein the device 
compresses at least a portion of the data packet to result in a size reduction 
of the IP-encapsulated packet prior to fonA^arding thereof. 

28. (original) The networking device of claim 18, wherein the device encrypts at 
least a portion of the data packet to provide a level of security prior to 
foHA/arding the IP-encapsulated packet. 

29. (currently amended) An apparatus for remote mirroring of network traffic 
between a local network layer 2 domain and a remote network layer 2 
domain, the apparatus comprising: 

an entry device configured to receive from the local network layer 2 

domain a data packet to be remotely mirrored to a remote exit 

device in the remote network layer 2 domain; 
a configuration file in the entry device, where the configuration file stores 

a destination Internet Protocol (IP) address to which to mirror the 

data packet; 

a remote mirroring engine for generating and adding an IP header to IP 
encapsulate the data packet, wherein the IP header includes the 
destination IP address, for reducing size of the data packet to 
accommodate the added IP header, and for having the IP- 
encapsulated packet fonfl/arded towards a remote exit device 
associated with the destination IP address , wherein the remote 
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mirroring engine includes a best effort mirroring mode to reduce 
head-of-line blocking . 
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